FBI links $6bn Binance theft to North Korea

The FBI says North Korea stole more than $6 billion in virtual assets from Binance on October 29, attributing the attack to its TraderTraitor group. The bureau’s statement on the Binance attack names the group and asks crypto firms to block transactions linked to the stolen assets. The theft is the largest crypto heist reported to date.

Binance’s initial investigation, reported by the Associated Press, points to a compromised DevOps engineer’s laptop. The attacker may have used it to access a service container and submit unauthorized withdrawal transactions. Binance said it had found no evidence that wallet private keys were leaked. In this kind of attack, the withdrawal system is the route out: an unauthorized transaction can move funds even if the underlying wallet key has not been exposed.

How did the stolen assets move?

The FBI says the attackers converted stolen assets primarily into ether, the cryptocurrency used on the Ethereum network. It expects further laundering through decentralized finance services and instant swap services. These tools can exchange assets or move them between addresses and networks, making it harder to follow the trail.

That is why the FBI has asked exchanges, blockchain analytics firms, DeFi services and other virtual asset providers to block transactions connected to addresses it has identified. A blockchain records transfers publicly, but the record does not automatically identify the people behind each address. Blocking funds at a participating service can interrupt a transfer before the assets move further.

What does the FBI’s North Korea attribution mean?

The FBI’s statement assigns responsibility to TraderTraitor, a name it uses for North Korean malicious cyber activity. The bureau says the same group was responsible for the theft from Binance; it does not publish a detailed account of how investigators linked this attack to the group. In February 2025, the FBI attributed the theft of about $1.5 billion from crypto exchange Bybit to TraderTraitor.

The attribution directs firms’ attention to the addresses and laundering routes named by investigators. It does not mean all the stolen assets have been recovered or frozen. Binance told the Associated Press that its estimated impact was about $6.3 billion and that it had frozen roughly $3 billion on-chain. The company said it would cover customer losses and had funds set aside to reimburse users.

What happens as the investigation continues?

The FBI says the funds may continue through DeFi and instant swaps before later laundering stages. Each service that receives or processes a transfer has a chance to identify an address on the FBI’s list and stop that transaction. The investigation and recovery effort therefore depend on coordination across exchanges, token networks and other crypto services.

Binance’s reported estimate and the FBI’s “more than $6 billion” figure describe the scale of the same incident. The bureau’s statement confirms its attribution and tracing concerns; Binance’s technical explanation remains an initial account pending its fuller investigation.

Sources

• statement on the Binance attack — fbi.gov